[PATCH] mei: lb: read the MTU once

[PATCH] mei: lb: read the MTU once

[Greg Kroah-Hartman]

From: Josef Bacik <josef@toxicpanda.com>

mei_cldev_mtu() returns 0 if the client is not connected. A link reset
disconnects all clients at any time, from the reset work.

mei_lb_push_payload_v2() asks for the MTU to allocate the request buffer
and asks again for every chunk. If the reset comes in between,

	chunk_size = min(payload_size - sent_data, 0 - sizeof(*req));

makes the chunk the whole rest of the payload, and the memcpy() behind it
writes over the end of the buffer. If the reset comes before the first
call, kzalloc(0) returns ZERO_SIZE_PTR, which passes the NULL check and is
dereferenced. An MTU not bigger than the request header has the same
effect as 0.

Read the MTU once and refuse one which leaves no room for payload. If the
client has gone, sending the chunk fails.

Fixes: 773a43b8627f ("mei: lb: add late binding version 2")
Cc: stable <stable@kernel.org>
Cc: Alexander Usyskin <alexander.usyskin@intel.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/misc/mei/mei_lb.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/misc/mei/mei_lb.c b/drivers/misc/mei/mei_lb.c
index 9fa69acf28d5..ffaf5be3b605 100644
--- a/drivers/misc/mei/mei_lb.c
+++ b/drivers/misc/mei/mei_lb.c
@@ -312,16 +312,24 @@ static int mei_lb_push_payload_v2(struct device *dev, struct mei_cl_device *clde
 	size_t chunk_size;
 	size_t req_size;
 	ssize_t bytes;
+	size_t mtu;
 	int ret;
 
-	struct mei_lb2_req *req __free(kfree) = kzalloc(mei_cldev_mtu(cldev), GFP_KERNEL);
+	/* The MTU turns into 0 when a link reset disconnects the client */
+	mtu = mei_cldev_mtu(cldev);
+	if (mtu <= sizeof(struct mei_lb2_req)) {
+		dev_err(dev, "MTU is too small: %zu\n", mtu);
+		return -EMSGSIZE;
+	}
+
+	struct mei_lb2_req *req __free(kfree) = kzalloc(mtu, GFP_KERNEL);
 	if (!req)
 		return -ENOMEM;
 
 	first_chunk = MEI_LB2_FLAG_FST_CHUNK;
 	last_chunk = 0;
 	do {
-		chunk_size = min(payload_size - sent_data, mei_cldev_mtu(cldev) - sizeof(*req));
+		chunk_size = min(payload_size - sent_data, mtu - sizeof(*req));
 
 		req_size = struct_size(req, payload, chunk_size);
 		if (sent_data + chunk_size == payload_size)
-- 
2.56.0